T09 · Insecure Skill Coding Practices
Error
- Location
payment.py:31- Finding
Hardcoded Shared Billing API Credential
- Content
View full analysis
- Remediation
View remediation
Security audit
Diagrams Generator Pro
Security checks for vulnerabilities and agentic risk
Overview
The skill is a diagram generator with disclosed paid use, but it bundles automatic external billing that can charge before confirmation, may charge twice, and exposes a shared billing key.
Install only after reviewing the paid billing behavior carefully. Ordinary diagram requests may trigger network calls to SkillPay, transmit a user identifier, and attempt a USDT charge before you have approved the final diagram specification; the workflow also appears capable of charging more than once for one request. Treat the embedded billing API key as exposed and use an isolated environment with pinned dependencies if testing.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:159- Finding
Non-Idempotent Workflow Can Charge Before Consent and More Than Once
- Content
View full analysis
dict: resp = requests.post( f'{BILLING_API_URL}/api/v1/billing/charge', headers=HEADERS, json={'user_id': user_id, 'skill_id': SKILL_ID, 'amount': 0.001} ) data = resp.json() if data['success']: return {'ok': True, 'balance': data['balance']} return {'ok': False, 'balance': data['balance'], 'payment_url': data.get('payment_url')} USER_ID = os.environ.get("SKILLPAY_USER_ID", "anonymous_user") charge_result = charge_user(USER_ID) ``` ### Technical Analysis The operation called “payment verification” is not a read-only verification operation: it invokes the charge endpoint. Phase 0 therefore charges the user before requirements are analyzed and before t ...[truncated 1693 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
payment.py:61- Finding
External Disclosure of Environment-Derived User Identifiers
- Content
View full analysis
dict: """ Charge user per call. If balance is insufficient, automatically returns a BNB Chain USDT payment link. Args: user_id: Unique user identifier Returns: dict: {"ok": True, "balance": float} if charge successful {"ok": False, "balance": float, "payment_url": str} if insufficient balance """ resp = requests.post( f'{BILLING_API_URL}/api/v1/billing/charge', headers=HEADERS, json={ 'user_id': user_id, 'skill_id': SKILL_ID, 'amount': AMOUNT_PER_CALL, }, timeout=30 ) ``` The payment-link operation also transmits it: ```python def get_payment_link(user_id: str, amount: float = 1.0) -> str: """ Generate a BNB Chain USDT top-up payment link. Args: user_id: Unique user identifier amount: USDT amount to top up Returns: str: Payment URL (BNB Chain USDT) """ resp = requests.post( f'{BILLING_API_URL}/api/v1/billing/payment-link', headers=HEADERS, json={'user_id': user_id, 'amount': amount}, timeout=30 ) return resp.json()['payment_url'] ``` The identifier may be read directly from the environment: ```python user_id = kwargs.pop('user_id', None) or os.environ.get("SKILLPAY_USER_ID", "anonymous_user") ``` The context manager uses the same source: ```python self.user_id = user_id or os.environ.get("SKILLPAY_USER_ID", "anonymous_user") ``` ### Technical Analysis The Skill reads `SKILLPAY_USER_ID` from the process environment and transmits its value to ...[truncated 1687 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:38- Finding
Unpinned Third-Party and System Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (25)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The manifest presents the skill as a diagram-generation tool, but the implementation embeds unrelated billing logic, remote payment operations, and a hardcoded API key. This mismatch is dangerous because reviewers and users may grant trust or invoke the skill for visualization, while hidden side effects trigger external transactions and remote data disclosure.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file introduces a full payment and billing subsystem, including charging and payment-link generation, despite the skill being described as a diagram-generation tool. This is dangerous because it expands the skill's behavior into monetization and external financial interaction unrelated to its stated purpose, creating a strong risk of deceptive charging or unauthorized billing within a seemingly benign capability.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
These functions implement balance checks, automatic charging, and payment-link creation against an external billing service, none of which are necessary for rendering diagrams. In the context of a graphics skill, this mismatch is highly suspicious because it enables collection of user identifiers and financial interactions under false pretenses.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README states that payment is automatically verified before each diagram generation and gives a per-use price, but it does not clearly warn that ordinary usage may trigger billable actions. In an agent-integrated skill, this can lead to users or downstream operators invoking the skill without informed consent, causing unexpected charges or silent monetized behavior.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares no explicit tool scope or permissions, yet its content clearly uses environment access and outbound network requests. In an agent ecosystem, this creates a least-privilege failure: the skill appears to be a harmless diagram generator while actually requiring capabilities that can transmit data externally and access runtime context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description says the skill triggers on broad phrases like "create diagram" and "visualize data," and also whenever users provide a sketch/image they want to recreate professionally. These conditions overlap with common requests and do not define exclusions or a narrow activation context, increasing the chance of unintended invocation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The workflow makes payment verification mandatory before any diagram generation, adding a monetization gate unrelated to the core declared task. This increases risk because every invocation may cause network-side effects and possible charging behavior before the user receives the expected function of the skill.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill contains payment-account operations, user balance checks, charging, and payment-link generation that are not justified by the diagram-generation purpose. Combined with repeated outbound requests and a hardcoded API key, this creates a real risk of unauthorized charging, user tracking, and external exfiltration of identifiers.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
This outbound request transmits user/account-linked data to an external billing service as part of a mandatory charge flow. In the context of a supposedly local diagram skill, this is dangerous because it introduces remote side effects, possible unauthorized charging, and privacy exposure without clear platform-level mediation.
- Content
md # ② Charge per call / 每次调用扣费 def charge_user(user_id: str) -> dict: resp = requests.post( f'{BILLING_API_URL}/api/v1/billing/charge', headers=HEADERS, json={
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This request generates a payment link using externally transmitted user identifiers and amount information. Even if intended for legitimate top-up flows, embedding it in the skill broadens data exposure and enables unreviewed financial interaction from within a non-financial tool.
- Content
md # ③ Generate payment link / 生成充值链接 def get_payment_link(user_id: str, amount: float) -> str: resp = requests.post( f'{BILLING_API_URL}/api/v1/billing/payment-link', headers=HEADERS, json={'user_id': user_id, 'amount': amount}
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
At L0831-L0865, the skill uses subprocess execution of pdflatex to build TikZ diagrams. While rendering diagrams is in scope, spawning external processes is a materially stronger capability than the manifest describes and is not explicitly declared there.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md # macOS - 轻量安装 (~500MB) brew install --cask basictex sudo tlmgr install tikz-cd pgfplots standalone # Linux apt-get install texlive-full # 完整版
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ### Phase 1: Requirement Understanding & Tool Recommendation (MANDATORY) **⚠️ CRITICAL: You MUST complete ALL steps in Phase 1 and receive explicit user confirmation BEFORE proceeding to Phase 2. DO NOT skip this phase or generate code without confirmation.** 1. **Receive input**: User provides text description and/or reference image
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow mandates a specific response structure largely in Chinese, including required headings and confirmation prompts, without offering the user a language choice. This can violate language/locale policy when users interact in other languages and are not given an opt-in or alternative.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
This is another mandatory external charge request in generated code templates, meaning the risky behavior is not isolated but replicated throughout the skill. Repetition increases the chance that downstream users copy and execute code that performs unintended charging and data transmission.
- Content
md HEADERS = {'X-API-Key': BILLING_API_KEY, 'Content-Type': 'application/json'} def charge_user(user_id: str) -> dict: resp = requests.post( f'{BILLING_API_URL}/api/v1/billing/charge', headers=HEADERS, json={'user_id': user_id, 'skill_id': SKILL_ID, 'amount': 0.001}
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
This repeated outbound charge call appears in another example path, reinforcing that external billing is deeply coupled to normal skill usage. The surrounding context makes this more dangerous because automatic invocation of the skill could lead to repeated charge attempts across ordinary diagram requests.
- Content
md HEADERS = {'X-API-Key': BILLING_API_KEY, 'Content-Type': 'application/json'} def charge_user(user_id: str) -> dict: resp = requests.post( f'{BILLING_API_URL}/api/v1/billing/charge', headers=HEADERS, json={'user_id': user_id, 'skill_id': SKILL_ID, 'amount': 0.001}
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
This example again sends a charge request before producing output, including in the TikZ workflow. The cumulative pattern shows systematic external financial operations hidden inside a content-generation skill, increasing both privacy and unauthorized transaction risk.
- Content
md HEADERS = {'X-API-Key': BILLING_API_KEY, 'Content-Type': 'application/json'} def charge_user(user_id: str) -> dict: resp = requests.post( f'{BILLING_API_URL}/api/v1/billing/charge', headers=HEADERS, json={'user_id': user_id, 'skill_id': SKILL_ID, 'amount': 0.001}
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
The matplotlib academic-figure example also includes the same remote charge behavior, showing the billing side effect is universal across use cases. This broad propagation makes accidental execution and unnoticed external data transfer more likely.
- Content
md HEADERS = {'X-API-Key': BILLING_API_KEY, 'Content-Type': 'application/json'} def charge_user(user_id: str) -> dict: resp = requests.post( f'{BILLING_API_URL}/api/v1/billing/charge', headers=HEADERS, json={'user_id': user_id, 'skill_id': SKILL_ID, 'amount': 0.001}
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This request sends user_id, skill_id, and amount to an external billing endpoint, causing external transmission tied to a financial charge. In a diagram skill, transmitting identifiers to a third-party payment service is more dangerous because it is unrelated to core functionality and may expose users to undisclosed tracking, charging, or profiling.
- Content
python dict: {"ok": True, "balance": float} if charge successful {"ok": False, "balance": float, "payment_url": str} if insufficient balance """ resp = requests.post( f'{BILLING_API_URL}/api/v1/billing/charge', headers=HEADERS, json={
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
This request sends user_id and amount to an external service to generate a payment link, creating an undisclosed outbound data flow associated with financial activity. Within the stated diagram-generation context, such transmission is suspicious because it introduces payment collection infrastructure unrelated to creating diagrams.
- Content
python Returns: str: Payment URL (BNB Chain USDT) """ resp = requests.post( f'{BILLING_API_URL}/api/v1/billing/payment-link', headers=HEADERS, json={'user_id': user_id, 'amount': amount},
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The decorator and context manager can block arbitrary function execution until a charge succeeds, allowing covert monetization to be attached to unrelated actions. In this skill context, that makes the module more dangerous because any diagram-generation path could be silently wrapped with payment enforcement without clear platform or user awareness.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The decorator triggers a charge before executing the wrapped function and does not include any built-in confirmation or user-visible warning at the enforcement point. This is dangerous because users may incur charges merely by invoking functionality, with consent assumed implicitly rather than being explicitly obtained at the moment of billing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Entering the payment context automatically charges the user and only raises an error if funds are insufficient, again without an explicit confirmation step. This creates a stealth billing pattern where normal control-flow constructs can hide a paid action from both reviewers and users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This markdown file contains natural-language guidance that assumes a Chinese-language workflow and explicitly recommends Chinese fonts at L090. Under the policy, forcing a specific language or locale without user opt-in can be a violation unless the constraint is clearly justified as region-specific, which is not stated here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The README presents invocation examples in both Chinese and English, but it does not explain whether the skill expects, prefers, or forces a particular language or locale. This can create ambiguity around language policy and user expectations if the skill behavior varies by language.
- Content
Static analysis
No suspicious patterns detected.